Skip to content

Set-DbaLogin - Read only the logins of -Login from the instance - #10809

Merged
potatoqualitee merged 1 commit into
developmentfrom
set-dbalogin-read-requested-logins
Oct 26, 2026
Merged

potatoqualitee merged 1 commit into
developmentfrom
set-dbalogin-read-requested-logins

Conversation

@andreasjordan

Copy link
Copy Markdown
Collaborator

Fixes #10807

Problem

With -SqlInstance, Set-DbaLogin called Get-DbaLogin -SqlInstance $server without -Login and picked the logins of -Login out of the result afterwards. Get-DbaLogin processes every login it returns (the "Processing [...]" verbose lines in the issue), so changing one login read every login of the instance, which takes long on an instance with many logins or one far away. Sync-DbaLoginPassword calls Set-DbaLogin once per login and destination, so syncing one password did the same.

Change

The call passes -Login. The filter after it stays: it still keeps the ##...## system logins out, and Get-DbaLogin matches the names the same way (-in). Piped logins (-InputObject) are not affected.

The other login commands that call Get-DbaLogin already pass -Login (Sync-DbaLoginPassword for the source, Sync-DbaLoginPermission, Copy-DbaLogin, Test-DbaLoginPassword). Compare-DbaAgReplicaLogin and Compare-DbaAgReplicaSync compare all logins on purpose.

Tests

New context in tests/Set-DbaLogin.Tests.ps1: of two new logins, one is disabled with -Verbose, and the verbose messages Get-DbaLogin writes for every login it processes may name only that one.

Lab: Set-DbaLogin.Tests.ps1 61 passed on Windows PowerShell 5.1 and on PowerShell 7.6 (single instance SQL Server 2019), Sync-DbaLoginPassword.Tests.ps1 11 passed on 5.1, dbatools.Tests.ps1 81 passed and 6 skipped. With the Set-DbaLogin.ps1 of development, the new test fails: the verbose messages name all 13 logins of the instance, the second test login among them.

馃 Generated with Claude Code

For -SqlInstance, the command called Get-DbaLogin without -Login and picked the logins of -Login out
of the result afterwards. Get-DbaLogin processes every login it returns, so changing one login read
all logins of the instance, which takes long on an instance with many logins or one far away.
Sync-DbaLoginPassword calls it once per login and destination, so a sync of one login did the same.
The call now passes -Login; the filter after it stays for the system logins.

The new context changes one of two new logins with -Verbose and checks the messages Get-DbaLogin
writes for every login it processes: only that login may be among them.

Fixes #10807

(do Set-DbaLogin, Sync-DbaLoginPassword)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@potatoqualitee potatoqualitee left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed at a0eae5d.

Passing -Login through to Get-DbaLogin correctly limits per-login processing while preserving name matching, the system-login exclusion, pipeline input, and multiple-instance behavior. Rename collision detection still uses the server's full login collection.

The new integration regression verifies that the selected login is changed and that unrelated logins are not processed. Reviewed the complete patch, surrounding source, tests, linked issue, discussions, and CI. No material defect found.

All 20 executed exact-head checks passed; one generic Windows job was skipped. No SQL Server integration suite was rerun locally.

@potatoqualitee
potatoqualitee merged commit ec21682 into development Oct 26, 2026
22 checks passed
@potatoqualitee
potatoqualitee deleted the set-dbalogin-read-requested-logins branch October 26, 2026 07:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Sync-DbaLoginPassword\Set-DbaLogin enumerates all server logins every time

2 participants